fix: CORS default was allow-all while docs claimed a localhost allowlist - #128
Merged
Merged
Conversation
The CORS allowed origins default was changed to allow all origins
("*") in commit 59ddb9b on 2026-04-28, while the docs still describe
a localhost allowlist. Restore the safe default that commit ce043fe
introduced on 2026-03-08: http://localhost:3000,http://localhost:8080.
The CORS_ALLOWED_ORIGINS env var still overrides the default for any
deployment that needs a different origin list.
Update the test that had been changed to assert the wildcard default
so it now asserts the restored localhost allowlist.
Sirajmx
approved these changes
Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cors_allowed_originsinsrc/ad_buyer/config/settings.pydefaulted to"*"(allow all origins), while every docs page describing this setting (docs/guides/configuration.md,docs/guides/deployment-ops-guide.md,docs/ai-assistant/developer-setup.md) states the default is a localhost allowlist. This PR restores the code to match the documented, safe default.Behavior change
Deployments that were relying on the implicit
"*"default now gethttp://localhost:3000,http://localhost:8080instead. Any deployment that needs browser clients from other origins to reach the API must now setCORS_ALLOWED_ORIGINSexplicitly (env var, unchanged mechanism). The env override still works exactly as before; only the default changes.Regression history
ce043fe): safe default introduced, settingcors_allowed_originstohttp://localhost:3000,http://localhost:8080and replacing an unauthenticated wildcard CORS policy.59ddb9b, PR Fix MCP and CORS #83): default silently reverted to"*"as part of an MCP/CORS change. A same day follow up (10627e3, PR Restore SSE legacy + update tests + docs after PR #83 #85) updatedtests/unit/test_random_seed_and_cors.py::test_settings_default_cors_originsto assert the wildcard instead of catching the regression, so CI stayed green while the default drifted from the documented behavior.cors_allowed_originstohttp://localhost:3000,http://localhost:8080and updates the test, and its now stale "wildcard is correct" comments, to assert and describe the restored default.Test plan
ruff check src/ tests/andruff format --check src/ tests/cleantests/unitsuite green: 3500 passed, 1 skippedtests/unit/test_random_seed_and_cors.py(7 tests) passes, now asserting the localhost defaultCORS_ALLOWED_ORIGINSenv override still works (unchanged code path, covered bytest_settings_custom_cors_origins)